FortiSwitch Deployment and Management
What this domain tests
The Deployment and Management domain checks whether you can choose the right operating model for a FortiSwitch and then keep it manageable: standalone versus FortiLink, discovery and authorization, FortiLink topology, firmware/image handling, configuration backup, and MCLAG redundancy. The exam favors operational decisions, not just menu locations.
Core rules
- Standalone mode: the FortiSwitch is configured locally through its own GUI/CLI. It can run VLANs, STP, LAG, 802.1X, and other L2 features, but the FortiGate does not push its configuration.
- FortiLink mode: a FortiGate interface (physical or LAG) becomes the FortiLink; the FortiGate's switch controller discovers, authorizes, and configures the switch. The managed switch appears under the FortiGate's managed-switch list, and most port/VLAN settings are made on the FortiGate.
- Authorization is a gate: a discovered switch is not managed until it is authorized. An unauthorized or deauthorized switch will not receive the expected FortiLink configuration.
- FortiLink LAG vs MCLAG: a FortiLink LAG bundles multiple links to the same switch. MCLAG presents two switches as one logical LAG endpoint, with an inter-switch link between the peers. Use MCLAG when you need redundant switch chassis, not a single LAG stretched to two independent switches.
- Firmware and backup: managed switches can be upgraded from the FortiGate; keep the FortiGate and FortiSwitch firmware compatible. In FortiLink mode, much of the switch configuration lives in the FortiGate configuration, so a FortiGate backup is part of the recovery plan; standalone switches need their own backup.
Worked example
A branch has one FortiGate and two FortiSwitch 424E units. The design needs both switches managed centrally and redundant links to the FortiGate, with no STP-blocked uplink. The correct choice is FortiLink MCLAG: connect one FortiLink port to each switch, configure the inter-switch link, form the MCLAG peer, then authorize both switches. The FortiGate sees a logical MCLAG and can forward across both links. A single FortiLink LAG with one member to each switch would create a loop and is not the MCLAG design.
Traps that cost marks
- Assuming a standalone switch will appear in the FortiGate switch controller without being converted/authorized.
- Forgetting that changing the FortiLink native VLAN or removing a required VLAN from the FortiLink trunk can cut management access.
- Building MCLAG with mismatched ISL or member-port settings.
- Treating a FortiLink LAG and an MCLAG as interchangeable.